| 1 | System Administration and IP Services |
|---|
| 2 | TCP/IP Networking Exercises |
|---|
| 3 | Practice: ping, netstat, tcpdump, traceroute, arp, route |
|---|
| 4 | |
|---|
| 5 | 1. Check your network configuration |
|---|
| 6 | -------------------------------- |
|---|
| 7 | |
|---|
| 8 | Check it with: |
|---|
| 9 | |
|---|
| 10 | $ ifconfig eth0 |
|---|
| 11 | |
|---|
| 12 | Do you see an IP address on your network card? It should look like this: |
|---|
| 13 | |
|---|
| 14 | eth0 Link encap:Ethernet HWaddr 52:54:8e:12:66:49 |
|---|
| 15 | inet addr:10.10.0.xx Bcast:10.10.0.255 Mask:255.255.255.0 |
|---|
| 16 | |
|---|
| 17 | Is your machine's IP address. |
|---|
| 18 | |
|---|
| 19 | If you eth0 network card does not have a 10.10.0.xx IP address, then you |
|---|
| 20 | could configure it as follows, but DON'T DO THIS NOW: |
|---|
| 21 | |
|---|
| 22 | $ sudo ifconfig eth0 10.10.0.xx/24 |
|---|
| 23 | $ sudo route add default gw 10.10.0.254 |
|---|
| 24 | |
|---|
| 25 | This is because you are logging in using ssh via the network interface, so |
|---|
| 26 | you may end up breaking your access to your machine. |
|---|
| 27 | |
|---|
| 28 | 2. netstat |
|---|
| 29 | ------- |
|---|
| 30 | |
|---|
| 31 | Look at your routing table: |
|---|
| 32 | |
|---|
| 33 | $ netstat ârn |
|---|
| 34 | |
|---|
| 35 | What do you notice? Is the default gateway configured? How do you know? Review the presentation if you are not sure. What is your default gateway? On what network interface is your default gateway valid for? |
|---|
| 36 | |
|---|
| 37 | Here's another way to look at your routing table: |
|---|
| 38 | |
|---|
| 39 | $ ip route |
|---|
| 40 | |
|---|
| 41 | 3. ping |
|---|
| 42 | ---- |
|---|
| 43 | |
|---|
| 44 | Let's ping the default gateway: |
|---|
| 45 | |
|---|
| 46 | $ ping 10.10.0.254 |
|---|
| 47 | |
|---|
| 48 | (Stop it with CTRL+C) |
|---|
| 49 | |
|---|
| 50 | Let's ping something outside, on the Internet. For example, lpnz.org |
|---|
| 51 | |
|---|
| 52 | $ ping nsrc.org |
|---|
| 53 | |
|---|
| 54 | Do you get an answer ? |
|---|
| 55 | |
|---|
| 56 | If not, check: |
|---|
| 57 | - That you have a gateway configured |
|---|
| 58 | - That in the file /etc/resolv.conf there is an entry for "nameserver" |
|---|
| 59 | - Do you notice anything about the response time? How far away is nsrc.org? |
|---|
| 60 | |
|---|
| 61 | Verify 10.10.0.254 is configured as your default gateway: |
|---|
| 62 | |
|---|
| 63 | $ netstat -rn |
|---|
| 64 | |
|---|
| 65 | Now, remove your default gateway: |
|---|
| 66 | |
|---|
| 67 | $ sudo route delete default |
|---|
| 68 | |
|---|
| 69 | Check that it's gone |
|---|
| 70 | |
|---|
| 71 | $ netstat -rn |
|---|
| 72 | |
|---|
| 73 | How can you be sure that the default gateway is no longer configured? Now, try to |
|---|
| 74 | ping the local NOC machine. |
|---|
| 75 | |
|---|
| 76 | $ ping 10.10.0.250 |
|---|
| 77 | |
|---|
| 78 | Now let's ping a machine outside our network (nsrc.org): |
|---|
| 79 | |
|---|
| 80 | $ ping nsrc.org |
|---|
| 81 | |
|---|
| 82 | The ip address of nsrc.org is 128.223.157.19 |
|---|
| 83 | |
|---|
| 84 | $ ping 128.223.157.19 |
|---|
| 85 | |
|---|
| 86 | What do you observe? |
|---|
| 87 | What is the consequence of removing the default gateway? |
|---|
| 88 | |
|---|
| 89 | Re-establish the default gateway: |
|---|
| 90 | |
|---|
| 91 | $ sudo route add default gw 10.10.0.254 |
|---|
| 92 | |
|---|
| 93 | Check that the default gateway is enabled again by pinging nsrc.org: |
|---|
| 94 | |
|---|
| 95 | $ ping nsrc.org |
|---|
| 96 | |
|---|
| 97 | 4. traceroute |
|---|
| 98 | ---------- |
|---|
| 99 | |
|---|
| 100 | Traceroute to nsrc.org |
|---|
| 101 | |
|---|
| 102 | $ traceroute nsrc.org |
|---|
| 103 | |
|---|
| 104 | Try again, this time with the -n option: |
|---|
| 105 | |
|---|
| 106 | $ traceroute -n nsrc.org |
|---|
| 107 | |
|---|
| 108 | Observe the difference with and without the '-n' option. Do you know what it is? |
|---|
| 109 | |
|---|
| 110 | 6. tcpdump |
|---|
| 111 | ------- |
|---|
| 112 | |
|---|
| 113 | Run tcpdump on your system: |
|---|
| 114 | |
|---|
| 115 | $ sudo tcpdump -n -i eth0 icmp |
|---|
| 116 | |
|---|
| 117 | (Note the use of the icmp keyword to limit viewing ICMP traffic) |
|---|
| 118 | |
|---|
| 119 | Ask the instructor(s) or your neighbor to ping your machine, and look at your screen. |
|---|
| 120 | |
|---|
